communication Archives

AppWizard

August 14, 2026

Threema messenger says DDoS attacks disrupted its service for two days

Threema experienced significant disruptions due to large-scale DDoS attacks, rendering the service inaccessible for several hours on Tuesday and causing intermittent outages on Wednesday morning. The attacks targeted both Threema and its Swiss colocation partner, Nine, with service being unavailable from 7:30 p.m. to 11:30 p.m. CEST on Tuesday. By 12:23 p.m. on Wednesday, normal operations were restored. The security of Threema's systems and user data remained intact despite the service availability issues. The nature of the attacks made mitigation challenging, as attackers modified their methods rapidly. Threema's status page faced issues during the outage, and communication was conducted via email and social media. In response, Threema is implementing specialized upstream DDoS protection and plans to enhance its status page to provide monitoring for future disruptions.

Winsage

August 14, 2026

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyte, also referred to as Mustang Panda, has been deploying an upgraded version of the CoolClient backdoor, which includes a signed Windows kernel-mode rootkit. This rootkit enhances the malware's ability to conceal malicious processes, files, registry objects, and command-and-control (C2) network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with confirmed targets including government entities. The CoolClient backdoor is deployed as a secondary access layer following an initial PlugX infection. The kernel component activates when CoolClient gains full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If these conditions are not met, the malware bypasses driver deployment and advances to the final-stage implant. Kaspersky has provided indicators of compromise (IoCs), including file hashes, paths, and C2 domains. In a campaign targeting Myanmar, HoneyMyte used PlugX as the initial implant to deploy CoolClient, which involved creating Microsoft Defender exclusions and renaming a legitimate executable for DLL sideloading. Persistence is achieved through a scheduled task that executes the binary with SYSTEM privileges at startup. Execution begins when a legitimate application loads a malicious DLL, which then manages persistence, registry modifications, UAC bypass, process injection, driver deployment, and C2 communications. When privileges are granted, the malware extracts a kernel driver, writes it to disk, and establishes a driver service. The driver is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. The driver receives configuration data from the CoolClient user-mode component and utilizes specific IOCTL requests to register trusted processes and protect filesystem and registry paths. The rootkit can limit access rights to protected processes, hide processes by unlinking them from the active process list, and deny access to protected files and directories. It also filters C2 IPv4 addresses from network information. The driver incorporates 33 IOCTL handlers, but only three were observed in use during standard execution. Kaspersky shared several file hashes related to the malware, including those for the kernel driver and malicious DLLs. This follows earlier disclosures regarding a newer CoolClient variant and a different HoneyMyte kernel-mode rootkit documented in December 2025.

Winsage

August 14, 2026

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

CoolClient is a sophisticated backdoor family linked to the HoneyMyte APT group, actively used in cyber-espionage campaigns targeting organizations in Asia and Russia since its initial disclosure in 2022. It has capabilities such as keylogging, clipboard theft, credential harvesting, and system reconnaissance. Investigations in 2023 revealed enhancements, including clipboard theft and HTTP traffic interception. By late 2025 and into 2026, a variant was noted that could deploy a signed kernel-mode driver as a Windows service, improving its stealth and operational capabilities. In a recent campaign targeting Myanmar, the HoneyMyte group used PlugX to deploy CoolClient components. They configured Microsoft Defender to exclude a fake Windows Defender installation directory and a renamed executable, defender.exe, to avoid detection. Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at startup, which sideloaded the malicious libngs.dll to initiate the CoolClient execution chain. The latest CoolClient variant has a multi-stage execution chain, including: - defender.exe / Sang.exe: Exploited legitimate application for DLL sideloading. - libsrapc.dll: Benign dependency for the Sangfor application. - libngs.dll: First-stage loader that decrypts and loads the next stage. - loadcert.ini: Second-stage DLL implementing core functionalities. - cert.ini: Final-stage implant for command and control communication. - time.ini: Configuration file for CoolClient. The execution begins with the legitimate Sangfor application loading libngs.dll, which uses obfuscation to conceal its operations. The second stage, loadcert.ini, is injected into synchost.exe and performs tasks including persistence and process injection. The kernel-mode driver deployment routine involves decrypting time.ini, verifying privileges, and creating a service to execute the driver, enhancing stealth. The deployed kernel-mode driver, msagent.sys, is digitally signed and helps hide processes, files, and registry objects, making detection more difficult. The latest variant continues to target organizations consistent with previous HoneyMyte activities, with confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The deployment of CoolClient as a secondary backdoor after a PlugX infection indicates a strategic approach to maintain access to compromised systems. The malware is confirmed as a new variant of CoolClient associated with the HoneyMyte threat group, with the kernel-mode driver marking a significant advancement in its capabilities.

Winsage

August 13, 2026

Microsoft is cutting off new Office features on Windows 10 soon

Devices using Microsoft 365 Apps on Windows 10 will experience a significant transition with the rollout of version 2608, which will end feature enhancements for applications like Word, Excel, and PowerPoint. Security updates will continue until October 10, 2028. The OneDrive desktop app on Windows 10 version 22H2 will also receive updates until October 10, 2028, while older versions will not. Microsoft recommends transitioning to Windows 11 to avoid performance and reliability issues with Microsoft 365 Apps.

AppWizard

August 13, 2026

Spotify’s Android app is breaking down, and subscribers are reaching their limit

Spotify's Android users are experiencing significant performance issues, including UI lag, frozen playback, and unresponsive controls. The company acknowledged these concerns earlier this month but has not provided updates or timelines for resolution. Many subscribers are considering switching to alternatives like YouTube Music or Apple Music due to these ongoing problems. Complaints have surged on platforms like Reddit, detailing issues such as frozen screens and delayed button responses. Users feel neglected due to the lack of communication from Spotify regarding stability fixes. Currently, they are resorting to temporary measures like force-stopping the app and clearing cache files while awaiting a resolution.

AppWizard

August 13, 2026

Starship job simulation game Contact Protocol launches in spring 2027 for PS5, Xbox Series, Switch 2, and PC

Kinetic Publishing has partnered with Cold Zephyr Games to release the starship job simulation game Contact Protocol on PlayStation 5, Xbox Series, Switch 2, and PC via Steam, with a planned release in spring 2027. The game places players in the role of a security officer aboard the starship Pale Horse, requiring them to assess the intentions of approaching ships and make critical decisions that can have significant consequences. Key features include investigating incoming data, multitasking under pressure, and making choices that affect relationships and narratives. The game offers unique procedural encounters and a visually striking science-fiction world. A video and screenshots showcasing the game have been released.

AppWizard

August 12, 2026

Automattic has introduced the Mesh app for Android

Automattic has launched the Android version of its app, Mesh, which helps users manage personal and professional contacts with privacy. Mesh allows users to visualize their network, add notes, and set reminders. The Android version utilizes features like split-screen mode, pop-up windows, and supports keyboard shortcuts on foldable devices. It includes in-app search, home screen widgets, and real-time synchronization. Mesh partially integrates with Automattic’s Beeper messenger for streamlined communication. Currently in early access, Nexus AI enhances user experience by enabling intuitive queries about contacts. Mesh prioritizes user privacy and operates on a subscription model, offering a free version with a limit of 1,000 contacts and paid tiers for unlimited contacts. Approximately 70% of users utilize Mesh for business purposes. The app, formerly known as Clay, is available on Google Play and compatible with various devices.

AppWizard

August 12, 2026

Google passes 1 bln monthly users for Gemini app

Google's Gemini app has surpassed 1 billion monthly active users. Approximately 63 percent of users engage with the app vocally, and 20 percent use visual communication methods like the app's camera and screen-sharing features. Most users access Gemini on Android devices, but 10 percent use Apple devices.

AppWizard

August 12, 2026

Russia charges Telegram CEO Pavel Durov with aiding terrorism

Russian authorities have charged Pavel Durov, the founder and CEO of Telegram, with aiding terrorism and placed him on an international wanted list. The Federal Security Service (FSB) alleges that Telegram facilitates criminal activities and operations related to Ukrainian intelligence, classifying it as a facilitator of "acts of sabotage and terrorism, mass murder, and cyber fraud." Instead of targeting the platform with fines or restrictions, Russian authorities are pursuing Durov personally. If convicted in Russia, he faces the possibility of life imprisonment. This case reflects a broader trend of governments holding technology executives accountable for content and activities on their platforms, with similar legal pressures observed on other platforms like Meta, TikTok, Snap, and YouTube.

AppWizard

August 12, 2026

Privacy or Evasion? The Policy Dilemma Around Messaging App Usernames

On June 29, 2026, WhatsApp introduced a feature allowing users to create usernames to enhance privacy by enabling connections without revealing phone numbers. The Government of India expressed concerns about potential increases in cybercrime linked to this feature and issued a notice to WhatsApp requesting a pause on its rollout. The notice demanded justification under various laws, including the Information Technology Act, 2000. Similar inquiries were sent to other messaging platforms like Telegram and Signal. This scrutiny represents a shift from reactive measures to proactive assessments of platform design, emphasizing how features like usernames can impact user safety and accountability. The Delhi High Court upheld a temporary ban on Telegram during an examination period, recognizing the relevance of platform architecture in assessing risks. The increase in cybersecurity incidents in India raised concerns about usernames enabling fraud and evasion. The government is advocating for a balanced approach that allows pseudonymous interaction while ensuring accountability.